---------------------------------------------------
A] buffer-overflow in the handling of the subtitles
---------------------------------------------------

VLC is able to handle the subtitles automatically in a very simple way,
it just checks the presence of ssa files with the same name of the
loaded video and a possible subtitles folder.
The functions which handle the MicroDvd, SSA and Vplayer subtitle
formats are vulnerable to some stack based buffer-overflow
vulnerabilities which can allow an attacker to execute malicious code.

As written in the header of this advisory, these buffer-overflow bugs
have been originally found and reported by Michal Luczaj this summer
and the strange thing is that the SVN is fixed from that time BUT the
current 0.8.6d (both executables and source code!) is still vulnerable.
References:

VLC can be controlled remotely through a nice web interface (a mini
http server) which runs by default on port 8080.
The instructions which handle the Connection parameter sent by the
client pass its content to the httpd_MsgAdd function without the
needed format argument.
In addition the new formatted Connection field is also sent back by the
server in its reply, very useful for the attacker to tune the own
exploit for increasing the percentage of success of the attack.